vcl108: #i107271# fix invalid iterator access (thanks cmc)

1 files changed, 16 insertions, 2 deletions

diff --git a/vcl/unx/source/gdi/salgdi.cxx b/vcl/unx/source/gdi/salgdi.cxx
index c09803dcb269..490a92d12a0f 100644
--- a/vcl/unx/source/gdi/salgdi.cxx
+++ b/vcl/unx/source/gdi/salgdi.cxx
@@ -1427,14 +1427,17 @@ bool X11SalGraphics::drawPolyPolygon( const ::basegfx::B2DPolyPolygon& rOrigPoly
         // unless it splits another trapezoid that is still active
         bool bSplit = false;
         ActiveTrapSet::iterator aActiveTrapsIt = aActiveTraps.begin();
-        for(; aActiveTrapsIt != aActiveTraps.end(); ++aActiveTrapsIt )
+        while(aActiveTrapsIt != aActiveTraps.end())
         {
             XTrapezoid& rLeftTrap = aTrapVector[ *aActiveTrapsIt ];
 
             // skip until first overlap candidate
             // TODO: use stl::*er_bound() instead
             if( IsLeftOf( aTrapezoid.left, rLeftTrap.left) )
+            {
+                ++aActiveTrapsIt;
                 continue;
+            }
 
             // in the ActiveTrapSet there are still trapezoids where
             // a vertical overlap with new trapezoids is no longer possible
@@ -1445,15 +1448,26 @@ bool X11SalGraphics::drawPolyPolygon( const ::basegfx::B2DPolyPolygon& rOrigPoly
             {
                 ActiveTrapSet::iterator it = aActiveTrapsIt;
                 if( aActiveTrapsIt != aActiveTraps.begin() )
+                {
                     --aActiveTrapsIt;
-                aActiveTraps.erase( it );
+                    aActiveTraps.erase( it );
+                    ++aActiveTrapsIt;
+                }
+                else
+                {
+                    aActiveTraps.erase( it );
+                    aActiveTrapsIt = aActiveTraps.begin();
+                }
                 continue;
             }
 
             // check if there is horizontal overlap
             // aTrapezoid.left==rLeftTrap.right is allowed though
             if( !IsLeftOf( aTrapezoid.left, rLeftTrap.right ) )
+            {
+                ++aActiveTrapsIt;
                 continue;
+            }
 
             // prepare to split the old trapezoid and keep its upper part
             // find the old trapezoids entry in the VerticalTrapSet and remove it